Critical Remote Code Execution Vulnerability in Node.js Package
Summary
UBUNTU-CVE-2021-22931: Node.js before 16.6.0, 14.17.4, and 12.22.4 is vulnerable to Remote Code Execution, XSS, Application crashes due to missing input validation of host names returned by Domain Name Servers in Node.js dns library which can... Affects nodejs versions < 0.10.25~dfsg2-2ubuntu1.2+esm1. Fixed in 0.10.25~dfsg2-2ubuntu1.2+esm1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Node.js is a popular open-source runtime environment that allows developers to execute JavaScript code server-side. It is widely used for building scalable network applications. The affected versions of Node.js have a vulnerability in the dns library, which is responsible for handling domain name resolution. This vulnerability can lead to severe security issues, including remote code execution and application crashes due to improper input validation.
Vulnerability Detail
The vulnerability, identified as CVE-2021-22931, affects Node.js versions prior to 16.6.0, 14.17.4, and 12.22.4. It arises from a lack of input validation for hostnames returned by Domain Name Servers. This oversight can lead to the output of incorrect hostnames, potentially resulting in domain hijacking and injection vulnerabilities in applications that utilize the dns library. The CVSS score for this vulnerability is 9.8, indicating a critical severity level.
How To Fix
Minimum fixed version
0.10.25~dfsg2-2ubuntu1.2+esm1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade nodejsTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, consider implementing strict input validation in your application to mitigate the risk of exploitation until the package can be updated. Ensure that any hostnames returned by the dns library are thoroughly validated against a whitelist of expected values.
Conclusion
The CVE-2021-22931 vulnerability in Node.js poses a serious threat to applications using the affected versions. It is crucial to update to the patched versions as soon as possible to mitigate the risks associated with remote code execution and domain hijacking. Implementing workarounds can provide temporary relief until a full update is feasible.
See every vulnerability recorded for nodejs →
FAQ
CVE-2021-22931 is a critical vulnerability in Node.js that allows for remote code execution due to improper input validation in the dns library.
Node.js versions prior to 16.6.0, 14.17.4, and 12.22.4 are affected by this vulnerability.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
Exploitation of this vulnerability can lead to remote code execution, application crashes, and domain hijacking, posing significant security risks.
If immediate updates are not possible, implement strict input validation in your application as a temporary workaround to reduce the risk of exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for nodejs.
